diff --git a/README.md b/README.md
index a8dcb7995..84659be12 100644
--- a/README.md
+++ b/README.md
@@ -275,6 +275,7 @@ A lot of projects use Mirror in production. If you found a critical bug / exploi
 **Credits / past findings / fixes:**
 * 2020, fholm: fuzzing ConnectMessage to stop further connects [[#2397](https://github.com/vis2k/Mirror/pull/2397)]
 * 2023-04-05: IncludeSec: [kcp2k UDP spoofing](http://blog.includesecurity.com/?p=1407) [[#3286](https://github.com/vis2k/Mirror/pull/3286)]
+* 2023-06-27: James Frowen: ClientToServer [SyncVar] [allocation attacks](https://github.com/MirrorNetworking/Mirror/pull/3562)
 
 ---
 # Credits & Thanks 🙏